1. Who we are
This Privacy Policy explains how Properation Consultant Limited OÜ (registry code 17176878, Vesivärava tn 50-301, Kesklinna linnaosa, 10152 Tallinn, Harju maakond, Estonia) processes personal data as a data controller, in accordance with the EU General Data Protection Regulation 2016/679 ("GDPR") and the Estonian Personal Data Protection Act.
Contact for data protection matters: [email protected].
2. What personal data we collect
Data you provide
- Contact form and email: name, business email, company, country, phone number (if provided), and the content of your message.
- Business relationships: names, job titles, and contact details of client and partner representatives; contract and invoicing information.
- End-user and marketing data in client projects: where we or our development partner process personal data held in a client's systems (for example customer-behaviour, registration, or campaign data in analytics projects), we do so as a processor on the client's behalf under a data-processing agreement; the client is the controller of that data.
- Due diligence: identification and ownership information about directors, authorised signatories, and beneficial owners of clients and partners, and results of sanctions screening.
Data collected automatically
- Technical data needed to deliver and secure the Website: IP address, browser type, date and time of access, and pages requested, recorded in server and security logs.
- Anti-spam check: if enabled on the contact form, a bot-protection service (such as Cloudflare Turnstile) processes technical signals from your browser to distinguish people from automated submissions.
We do not use advertising or analytics cookies on this Website.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Responding to inquiries and preparing proposals | (b) steps prior to entering into a contract; (f) legitimate interest in responding to business inquiries |
| Performing contracts with clients and partners, invoicing | (b) performance of a contract; (c) legal obligation (accounting) |
| Client and partner due diligence, sanctions screening | (c) legal obligation, where applicable; (f) legitimate interest in preventing financial crime and meeting the requirements of our banks |
| Website operation and security | (f) legitimate interest in a secure, functioning website |
| Establishing or defending legal claims | (f) legitimate interest |
4. Who we share data with
- Service providers acting on our behalf, such as website hosting, email, cloud storage, bot protection, and accounting providers, under data-processing agreements.
- Our development partner engaged on a client project, only to the extent necessary for that project and under confidentiality obligations.
- Banks and payment institutions, auditors, and professional advisers, where needed for payments, due diligence, or legal compliance.
- Authorities, where required by law.
We do not sell personal data.
5. International transfers
Some recipients are located outside the European Economic Area, including our development partner in Taiwan and clients in various countries. Where the destination country is not covered by an adequacy decision of the European Commission, we transfer personal data on the basis of the European Commission's Standard Contractual Clauses (GDPR Art. 46) together with appropriate supplementary measures, or, where applicable, on another basis permitted by GDPR Chapter V. You may request a copy of the relevant safeguards by contacting us.
6. How long we keep data
- Inquiries that do not lead to a contract: up to two (2) years after the last communication.
- Contract, invoicing, and accounting records: seven (7) years from the end of the financial year, as required by the Estonian Accounting Act.
- Due-diligence records: for the duration of the relationship and five (5) years after it ends.
- Server and security logs: normally up to ninety (90) days, unless needed to investigate an incident.
7. Your rights
Subject to the conditions of the GDPR, you have the right to access your personal data; to have it rectified or erased; to restrict or object to its processing (including processing based on legitimate interests); and to data portability. To exercise these rights, contact [email protected]. We will respond within one month.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority in your country of residence.
8. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access restricted to people who need it, multi-factor authentication for business systems, and confidentiality obligations for staff and partners.
9. Changes to this policy
We may update this Privacy Policy. The current version is always available on this page with its effective date.